Transparent Proxy

A transparent proxy is a mechanism that intercepts and redirects network traffic without requiring any changes to the application. It allows traffic to be automatically routed through a proxy without the application being aware of it.

When enabled, all inbound and outbound traffic is transparently routed through the data plane proxy. This allows users to benefit from Kuma’s features, such as traffic management, security policies, and observability, without modifying their applications.

Kubernetes

In Kubernetes mode, the transparent proxy is automatically set up and required. By default, it intercepts all incoming and outgoing traffic and routes it through the kuma-dp sidecar container.

Workload configuration depends on whether Kuma CNI is used:

• By default, (without Kuma CNI), the kuma-init init container is injected alongside the data plane proxy as part of the same process. It is responsible for setting up the transparent proxy.

• If Kuma CNI is enabled, the transparent proxy is installed during the CNI ADD operation, removing the need for kuma-init.

Kuma integrates with Kubernetes DNS for Services and Pods and provides its own Kuma DNS, which is especially useful for cross-zone service discovery in multi-zone setups.

Universal

Using the transparent proxy in Universal mode makes setup easier and enables features that wouldn’t be possible otherwise. Key benefits include:

• Simplified Dataplane resources: You can skip the networking.outbound section, so you don’t have to list each service your application connects to manually.

• Simplified service connectivity: Take advantage of Kuma DNS, for easy service connections without needing localhost and ports in the Dataplane resource.

firewalld support

The changes made by running kumactl install transparent-proxy will not persist after a reboot. To ensure persistence, you can either add this command to your system’s start-up scripts or use firewalld to manage iptables.

If you prefer using firewalld, set the KUMA_TRANSPARENT_PROXY_STORE_FIREWALLD environment variable to true when installing the transparent proxy. This stores the iptables rules in /etc/firewalld/direct.xml, ensuring they persist across system reboots.

Here’s an example:

KUMA_TRANSPARENT_PROXY_REDIRECT_DNS_ENABLED="true" \
KUMA_TRANSPARENT_PROXY_STORE_FIREWALLD="true" \
  kumactl install transparent-proxy

Transparent proxy with eBPF (experimental)

Starting from Kuma 2.0 you can set up transparent proxy to use eBPF instead of iptables.

kumactl install control-plane \
  --set "experimental.ebpf.enabled=true" \
  | kubectl apply -f-

kumactl install transparent-proxy \
  --ebpf-enabled \
  --ebpf-instance-ip <IP_ADDRESS> \
  --ebpf-programs-source-path <PATH>